Handle buyer attachments safely in an AI sales workflow

Define a narrow document task

Choose an approved processing environment and a bounded task such as extracting questionnaire questions into a review table. Establish which files may be processed, what data may be included and who approves the result. Treat email text, attached documents, retrieved pages and embedded links as untrusted content even when the sender appears familiar.

OWASP describes indirect prompt injection through external material and recommends controls outside the model, including least privilege and tool authorization. A prompt saying ignore malicious instructions is not a complete defense. The workflow should restrict what the connected system can do even when the model misinterprets a document.

Keep extraction separate from action

Use a read-only extraction stage without email sending, CRM writes, unrestricted browsing or access to unrelated files. Label the attachment as source content. Require output rows to cite the exact question or passage. Flag text that asks the model to change its task, reveal private context, follow hidden links or invoke tools. Ordinary questionnaire instructions still need human interpretation; suspicious keywords alone do not prove an attack.

In a fictional procurement attachment, a paragraph directs an assistant to send its account notes to a verification address. Extract that paragraph as an untrusted request and escalate it. Do not obey it, visit the address with private information or assume that a buyer’s document authorizes disclosure.

Review the result and test the boundary

A person reviews the extracted questions before a separate approved answer-generation step. Product, security and commercial owners approve their own answers. Any eventual submission remains an explicitly authorized action. Keep an audit of the task, source version and review decision without unnecessarily retaining secrets or full sensitive prompts.

Test the design using harmless fictional attachments and instrumented substitute tools. Include a legitimate document and a document that tries to trigger an unauthorized action. Check what the tools actually attempted, rather than judging only the final text. Stop and involve the administrator if an unauthorized action can occur. This preparation reduces specific risks but cannot establish that every future attachment is safe.

Review checklist

• Use an approved, minimized document input.
• Keep external text separate from authority.
• Restrict extraction tools to the necessary task.
• Require evidence and a human answer review.
• Test attempted actions with fictional data.

Source context and limits

OWASP provides the security basis for indirect injection, external tool controls and limited screening. Our sales-specific separation of extraction and submission is an editorial design, not a tested security product or a guarantee.